Skip to content

Latest commit

 

History

History
13 lines (9 loc) · 1.23 KB

additional-network.rst

File metadata and controls

13 lines (9 loc) · 1.23 KB

Additional Network Visibility

In the :ref:`network` section, we looked at network visibility provided by Security Onion itself. The ideal situation would be to have Security Onion network sensors covering each and every one of your network segments. If you're able to achieve that ideal situation, then you may not need any additional network visibility. However, there may be times when you simply can't cover certain network segments with Security Onion network sensors and that's when these additional options can be beneficial. Keep in mind, though, that the data that they provide is nowhere near as comprehensive as a full Security Onion network sensor. One option would be :ref:`netflow` logs from firewalls, switches, or routers showing what traffic was observed by the network device. Another option would be firewall logs showing what traffic was allowed through the firewall and what traffic was denied. Security Onion can consume :ref:`netflow` and firewall logs from :ref:`pfsense`, :ref:`opnsense`, and many other kinds of firewalls. You can find other firewall integrations in the :ref:`third-party-integrations` section.

.. toctree::
   :maxdepth: 2

   netflow
   pfsense
   opnsense